Splunk Search

create time range from times gleaned from one search to perform another search

freeti00
Explorer

I am searching some barracuda SMTP logs for some spam entries like this:

source="/data/log/barracuda" someuser@someco.com

feb 8 17:00:27 smtp02 scan[blah blah blah someuser@someco.com

feb 8 15:00:04 smtp01 scan[blah blah blah someuser@someco.com

I now want to take those times and create a range of time say ~4 minutes for each entry, so feb 8 16:56:27 - feb 8 17:00:27 and feb 8 14:04:04 - feb 8 14:08:04 and then perform a search in a source of data that has no common field that one might use a transaction for, in my case it is connection to a Cisco ACE load balancer and pick out only those entries with timestamps in those time ranges

source="/data/log/content.log" dest_port=25

Feb 8 16:59:01 mlvctga01lb :%ACE-6-302022: Built TCP connection 0x1ede30 for vlan129:10.10.200.166/46751 (10.10.201.18/6842) to vlan129:10.10.201.23/25 (10.10.200.11/25)

Feb 4 23:59:59 mlvctga01lb :%ACE-6-302022: Built TCP connection 0x1ede31 for vlan129:10.10.200.166/46751 (10.10.201.18/6842) to vlan129:10.10.201.23/25 (10.10.200.11/25)

the line in bold would be selected and I would end up with a table much like this:

time src_ip dest_ip
16:59:01 10.10.200.166 10.10.201.23

I looked at subsearch (some sucess), append, joins, etc.... but nothing seems to leap out at me as how to do this

Tags (1)
0 Karma

martin_mueller
SplunkTrust
SplunkTrust

In general you can collect filters for one search from a subsearch, even for timeranges. If you want to filter search A "four minutes around" the time given by one result from search B you can do something like this:

A [search B | head 1 | eval earliest=_time - 240 | eval latest = _time + 240 | return earliest latest]

Alternatively, specific to timeranges you can use localize something like this:

B | localize timebefore=240 timeafter=240 | map search="search A"

Note, the order of A and B is reversed in the second query.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...